Enterprise Network Deployment, 10,000 25,000 Users

Transcription

1 Enterprise Network Deployment, 10,000 25,000 Users Websense software can be deployed in different configurations, depending on the size and characteristics of the network, and the organization s filtering needs. Filtering components can be installed on a single machine, or distributed across multiple machines. See the Websense Web Security and Websense Web Filter Deployment Guide for more information about the components. This supplement provides system and deployment recommendations for an enterprise network (10,000 25,000 users). On average, enterprise networks have 500 1,250 requests per second (RPS). Additional supplements discuss networks of other sizes: Small (1 500 users) Medium (500 2,500 users) Large (2,500 10,000 users) Very large enterprise (25,000+ users) These network ranges are intended as general guidelines, given that the optimum deployment depends on the operating systems used, the size of the network, and the volume of Internet requests. Because of the size and distribution of the network, multiple instances of certain components may be needed. In environments with a large number of filtered machines, it may be appropriate to install multiple instances of Filtering Service for load balancing. Some load balancing configurations permit the same user to be filtered by different Filtering Service instances, depending on the current load. Multiple Network Agent instances may be needed to monitor Internet requests from all the machines in the network. You can also install multiple instances of other components, such as the transparent identification agents. The system recommendations described here maximize Websense component performance. You can also improve performance by using more powerful machines for resource intensive components, such as reporting. Deployment Guide Supplement 1

2 Some components may be able to run with smaller processors or less RAM, depending on the number of users, volume of Internet requests (RPS), and network topology. Note Network Agent can be deployed with other filtering components or on a separate machine for improved performance. Network Agent should not be deployed on the same machine as response-critical components or a firewall. See Deploying Network Agent in the Websense Web Security and Websense Web Filter Deployment Guide. The recommendations in this supplement are general guidelines. Contact Websense Sales Engineering for assistance in deploying Websense software in your large enterprise network. See the Deploying in a Distributed Environment supplement for more information about deploying and optimizing Websense software in a distributed, enterprise environment. Enterprise network overview Websense components should be distributed over 3 dedicated machines. Processor and RAM requirements for each machine match the requirements for a large network deployment. Unlike smaller networks, Network Agent and Filtering Service are installed on separate machines. Note Websense, Inc., recommends using dedicated machines for some Websense components. Only the Websense components and required supporting applications are installed on the machine. The tables in this section list possible configurations. deployment recommendations In an enterprise network, 3 dedicated machines are recommended to run Websense software. Table 1 provides deployment recommendations. Figure 1, page 5, shows a deployment in an enterprise network. 2 Websense Web Security and Websense Web Filter

3 See System Recommendations in the Websense Web Security and Websense Web Filter Deployment Guide for a complete list of supported operating systems and other component requirements. Table 1 deployment (enterprise network) Machine Software Hardware Recommendations Dedicated Machine #1 Policy Broker Policy Server Filtering Service Websense Master Database Transparent ID Agent: 1 DC Agent edirectory Agent Logon Agent RADIUS Agent User Service Usage Monitor Dedicated Machine #2 Websense Manager Requires Internet Explorer 7 or Firefox 2or 3 and Adobe Flash Player 8 or later Log Server Log Database 2 Microsoft SQL Server 2005/ GB of free disk space Free space must comprise at least 20% of the total disk space. 16 GB RAM or more 200 GB of free disk space utilizing a disk array 3 High-speed disk access Dedicated Machines (additional) 4 An additional machine or Network Agent machines running Network Agent may be needed, depending on the volume of Internet requests. Filtering Service, the transparent identification agents, and Network Agent can be installed on multiple machines to improve processing. Deployment Guide Supplement 3

4 Table 1 deployment (enterprise network) Machine Software Hardware Recommendations Filtering Service Websense Master Database Additional machines running Filtering Service are needed. The number of machines needed depends on the volume of Internet requests. 10 GB of free disk space Free space must comprise at least 20% of the total disk space. Network Agent processor, 3.20 GHz or Transparent ID Agent 1 DC Agent edirectory Agent Logon Agent RADIUS Agent 1. Transparent identification agents can be deployed alone or in certain combinations. For more information, see General Deployment Recommendations in the Websense Web Security and Websense Web Filter Deployment Guide. 2. The Log Database can also be created on an existing database server. 3. The Log Database needs a disk array, running RAID level 10, to increase I/O reliability and performance. 4. Network Agents should be installed on a separate machine in the network segments that they are assigned to monitor. For more information, see Chapter 3, Deploying Network Agent, in the Websense Web Security and Websense Web Filter Deployment Guide. If you install Network Agent on a machine also running Filtering Service, increase the RAM to 4 GB. 4 Websense Web Security and Websense Web Filter

5 Figure 1 illustrates the distribution of the Websense components in a enterprise network. This drawing is not a required configuration; the components may be deployed differently or on multiple segments. Figure 1 Overview of deployment (enterprise network) Deployment Guide Supplement 5

6 Linux deployment recommendations Most Websense components can run on either or Linux machines. At least 1 machine is needed if you want to run the complete reporting features in Websense Manager. Table 2 provides deployment recommendations. Figure 2, page 9, shows a Linux deployment for an enterprise network. See System Recommendations in the Websense Web Security and Websense Web Filter Deployment Guide for a complete list of supported operating systems and other component requirements. Table 2 Linux deployment (enterprise network) Machine Software Hardware Recommendations Dedicated Machine #1 Policy Broker Policy Server Filtering Service Websense Master Database Transparent ID Agent: 1 edirectory Agent Logon Agent RADIUS Agent User Service Usage Monitor Linux 10 GB of free disk space Free space must comprise at least 20% of the total disk space. Dedicated Machine #2 ( option) Dedicated Machine #2 4 (Linux option) Websense Manager Requires Internet Explorer 7 or Firefox 2or 3 and Adobe Flash Player 8 or later Log Server Log Database 2 Microsoft SQL Server 2005/2000 Websense Explorer for Linux Requires Apache Web server Log Database 2 Log Server for Linux MySQL GB RAM or more 200 GB of free disk space utilizing a disk array 3 High-speed disk access Linux 8 GB RAM or more 200 GB of free disk space utilizing a disk array 3 High-speed disk access 6 Websense Web Security and Websense Web Filter

7 Table 2 Linux deployment (enterprise network) Machine Software Hardware Recommendations Dedicated Machines (additional) (not dedicated) 5 An additional machine or Network Agent machines running Network Agent may be needed, depending on the volume of Internet requests. Linux or DC Agent Filtering Service, the transparent identification agents, and Network Agent can be installed on multiple machines to improve processing. These additional installations do not require dedicated machines. Filtering Service Websense Master Database Additional machines running Filtering Service are needed. The number of machines depends on the volume of Internet requests. Linux or 10 GB of free disk space Free space must comprise at least 20% of the total disk space. Network Agent processor, 3.20 GHz or Transparent ID Agent 1 DC Agent ( only) edirectory Agent Logon Agent RADIUS Agent Linux or Deployment Guide Supplement 7

8 1. Transparent identification agents can be deployed alone or in certain combinations. DC Agent is deployed on a separate machine only if transparent identification is needed for clients via a domain controller. For more information, see General Deployment Recommendations in the Websense Web Security and Websense Web Filter Deployment Guide. 2. The Log Database can also be created on an existing database server. 3. The Log Database needs a disk array, running RAID level 10, to increase I/O reliability and performance. 4. Linux-based reporting is available using Websense Explorer for Linux. This component requires Log Server for Linux and a MySQL database (a licensed install of v4.0x or v4.1). The Linux and reporting components are not cross-platform compatible. 5. Network Agent can run on either a Linux machine or a machine (but not the machine running the reporting components). Each Network Agent instance should be installed on a separate machine in the network segments it is assigned to monitor. For more information, see Deploying Network Agent in the Websense Web Security and Websense Web Filter Deployment Guide. If you install Network Agent on a machine also running Filtering Service, increase the RAM to 4 GB. 8 Websense Web Security and Websense Web Filter

9 Figure 2 illustrates the distribution of the Websense components in a Linux enterprise network. This drawing is not a required configuration; the components may be deployed differently or on multiple segments.. Figure 2 Overview of Linux deployment (enterprise network) Deployment Guide Supplement 9

10 10 Websense Web Security and Websense Web Filter